3 ms·
* From https://www.cloudflarechallenge.com/heartbleed https://www.cloudflarechallenge.com/heartbleed * So far, two people have independently solved the Heartbl
by tomkwok 13y ago
* From https://www.cloudflarechallenge.com/heartbleed https://www.cloudflarechallenge.com/heartbleed *
So far, two people have independently solved the Heartbleed Challenge.
The first was submitted at 4:22:01PST by Fedor Indutny (@indutny). He sent at least 2.5 million requests over the span of the challenge, this was approximately 30% of all the requests we saw. The second was submitted at 5:12:19PST by Illkka Mattila using around 100 thousand requests.
We confirmed that both of these individuals have the private key and that it was obtained through Heartbleed exploits. We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can’t be certain.
- tomkwok 13y agoMore details added on the page: "... by Illkka Mattila [of NCSC-FI] ..." (The National Cyber Security Centre Finland).
- danielweber 13y agoI wonder if the trick is to just send so many things that memory wraps around to a place where the key is exposed.
- chadillac 13y agoThat was my plan of attack, I left my machine at home sniffing, wonder if I caught it. Had bleed running in a while loop with no sleep and ab running on a loop as well sending connections to the server hoping to get the mem jostled around enough to cause something like that you described. I was unsuccessful as of 9:30AM... now I'm really curious to get home and see if I actually caught it... even though I already missed the $10k boat :(
- jneal 13y agoI probably hit the server only a thousand times thinking that could be enough, I was far off.